>You cannot export EU citizens' personal data from the EU to the US. If you want to process it in any way you have to do so in the EU or any country with equivalent rules and with a sufficient legal air-gap to stop the US's view that they're entitled to go anywhere they please to get any data they choose.
Absolutely true, but the USGov will lean on any organisation it can to get the data. The multinational is stuck with doing something illegal no matter what it does. I haven't heard of a resolution of USGov vs MS(Ireland) so even not being officially a US company is no protection. The only protection is the company being more afraid of the EU than it is of USGov - no appreciable US assets and no desire by directors to visit the US.
Having a (US) multinational unable to play in the space is viewed as intolerable by the USGov, so they are stuck with not wanting a resolution either way. They would rather play in a grey area. The latest US "cybersecurity" bill pretty much formalises this. "You give us everything we want and we won't tell." They won't need the NSA after that.
As far as Cloud goes, I'm not a fan. "We gave all your data away, but hey, it didn't cost us much to do it!" isn't the argument we want to hear. If you can't automate your IT, find someone with skills. AWS might be cheaper, but if you are a large business and your business model relies on that kind of cost saving, you've got the wrong business model. Perhaps the banning of US Cloud companies will spur the growth of Non-US cloud companies which fall only under national jurisdiction. Isn't that the point of it all - control of the data by those from whom the data is taken? Wouldn't Americans be incensed if their banking data was all processed in China? Guess what, despite the US' self-image, much of the world doesn't see them as "the good guys." If you want to be seen as the good guys, fix your legal system and your attitude of complete disregard for the rights and legal systems of others.
Biting the hand that feeds IT
